By Lewis Nibbelin, Research Writer, Triple-I
While the commercial cyber insurance market remains robust, rapid digitization and increasingly sophisticated cyberattacks have widened the protection gap for those most at risk. A new Triple-I Issues Brief examines where business preparedness falls short and what organizations can do to build resilience against future attacks.
Globally, the compound annual growth rate for cyber insurance premium has held steady at 5% since 2022, according to Swiss Re. North America represents the largest share, accounting for roughly two-thirds of the $16.4 billion in global premium estimated for 2026.
Despite the recent momentum, Chubb’s latest outlook on cyber claims found average claim severity doubled to more than $4.4 million for large U.S. businesses in 2025, even as claim frequency declined by 34% for the segment. Overall U.S. cyber-related losses totaled nearly $21 billion in 2025, up from about $16 billion in 2024, according to the FBI’s 2025 Internet Crime Report.
Much of the trend stems from the mounting complexity of cyberattacks themselves, as threat actors move beyond isolated exploits toward more targeted, technically advanced methods, including ransomware schemes and social engineering tactics powered by generative AI.
Phishing campaigns, for instance, can now be completed in mere minutes, propelled by deepfake technology capable of generating realistic visual and/or auditory impersonations of trusted individuals. As such, phishing attacks topped the list of complaints recorded in the FBI’s latest report, which noted AI-driven incidents of all types cost Americans nearly $893 million in 2025.
While public awareness of cyber risk is on the rise, cyber insurance take-up rates remain low, particularly among small and mid-sized businesses. Misunderstandings surrounding cyber risk coverage options and benefits help fuel this discrepancy, signaling a mismatch between insurer perceptions of product value and that of their customers.
Part of the disconnect may also reflect uneven AI and automation adoption, which continues to outpace internal oversight. Among organizations surveyed by IBM, only a third of those with governance policies maintained strict approvals for deploying AI, with even fewer reporting coordination among their governance and security teams.
Similarly, investments in AI without employee training or upskilling ranked as the top concern among HR and risk professionals surveyed in a 2026 Marsh report, at 40% of respondents. The trend suggests that though organizations may be more familiar with AI and cyber risks, they remain unaware of the underlying mechanisms behind them, demanding greater public education around cyber insurance and resilience broadly.
Learn More:
AI Adoption Outpaces Governance, Nationwide Finds
AI Efficiency Gains Pave Way for Insurance Affordability
Balancing Data Privacy with Modern Risk
